French bank Credit Mutuel Arkea confirmed on Wednesday that hackers executed fraudulent transfers from the institution’s own account following a sophisticated external cyberattack. While the lender stated that customer assets remain unaffected and operations are resuming, on-chain investigator ZachXBT estimated the total losses at more than $133 million, a figure the bank has not officially validated.
Attack Vector and Bank Response
Credit Mutuel Arkea stated that attackers gained access through the platform of a service provider rather than through human error or its online banking arm, Fortuneo. The intruders used the bank’s internal account to send transactions to other financial institutions, potentially converting the funds into cryptocurrency via specialized platforms. The bank emphasized that no customer accounts within its federations or subsidiaries were compromised during the incident.
In response to the breach, the Brittany-based lender suspended certain transactions as a precautionary measure. It reported that part of the stolen funds has been frozen and that recovery efforts for the remainder are underway. The bank asserted that the financial impact is not large enough to threaten its overall health or soundness, noting it holds approximately 211.5 billion euros in assets.
Discrepancy in Loss Estimates
While Credit Mutuel Arkea acknowledged the severity of the attack, it declined to confirm the specific loss figure of 118 million euros ($133 million) cited by investigators. A spokesperson told Reuters that it is too early to provide a final number, though the bank validated the order of magnitude. Earlier reports from AFP suggested a provisional internal estimate of around 100 million euros.
ZachXBT first flagged the incident on Monday, initially suspecting an EU entity had lost more than $106 million on November 1. He later updated his assessment after identifying an additional $27 million in exchange withdrawals, bringing the total to over $133 million. The investigator noted that the funds were withdrawn as USDC and USDT stablecoins, swapped for ether, and moved across multiple blockchain networks. He also expressed high confidence that the attack was not conducted by North Korea’s Lazarus Group.
Ongoing Investigation
Credit Mutuel Arkea is currently collaborating with judicial and police authorities to determine the precise origin and methodology of the attack. The bank has not disclosed when the breach began, who is responsible, or whether any sensitive data was exfiltrated. It has informed its supervisors and warned customers to remain vigilant against potential phishing attempts in the aftermath of the hack.
